Enterprise QoS Solution Reference Network Design Guide

Catalyst 6500 PFC2/PFC3—QoS Considerations and Design
2-80
Enterprise QoS Solution Reference Network Design Guide
Chapter 2 Campus QoS Design
Additionally, QoS policies may be applied to VLANs or to ports. There was never any significant
advantage of using one base over the other; however, AutoQoS tools favor port-based QoS, as it is
marginally simpler to configure. Port-based QoS is the default per-port setting and all examples in this
chapter are configured using port-based QoS.
All ports (once QoS has been globally enabled) are set to an untrusted state by default. Also, by default,
the trust-extension state is set to untrusted and the extended-CoS is correspondingly set to 0.
All packets received through an untrusted port (whether the untrusted port is the actual switch port or
the extended switch port in the back of a Cisco IP Phone) are marked to a CoS value of 3, by default.
This default marking should be set instead to 0 on all ports connected to untrusted endpoints by using
the command set port qos mod/port cos 0. Furthermore, on all ports that are connected to
conditionally-trusted endpoints (like Cisco IP Phones) it is recommended to use the command set port
qos mod/port cos 0 in conjunction with the command set port qos mod/port cos-ext 0.
It is recommended to leave all these port QoS settings at their defaults, with the exception of trust and
cos/cos-ext—depending on the access edge model to be applied to the port, as is discussed in additional
detail below.
Another Catalyst-OS default behavior to keep in mind is that ACLs and aggregate policers cannot be
applied to more than one port in the same manner as these can when configured in IOS. For example, if
an aggregate policer called POLICE-VOIP was defined to rate-limit flows to 128 kbps and if this
policer were applied to two separate ports in CatOS, then it would rate limit flows from both ports to
combined total of 128 kbps, instead of (the preferred behavior of) limiting flows to 128 kbps on a
per-port basis (as is the case when configured in IOS). To work around this default behavior, ACLs and
aggregate policers have to be uniquely defined on a per-port basis. To facilitate the administration of this
additional configuration complexity, it is recommended that all CatOS ACLs and aggregate policers be
defined with names that include the module and port they are to be applied to. For example, the
previously defined aggregate policer POLICE-VOIP would become POLICE-VOIP-3-1 when applied
to port 3/1 and POLICE-VOIP-3-2 when applied to port 3/2. This is the nomenclature adopted in the
examples to follow in this chapter.
Note Administrators should keep in mind the maximum number of aggregate policers that can be configured
via CatOS on a given Catalyst 6500 switch (currently 1023) when designing their access-edge policies.
Depending on the chassis/linecard combination, this maximum number of aggregate policers may
present scaling limitations to the advanced models presented in this design chapter.
Catalyst 6500—Trusted Endpoint Model
Configuration
This section includes the following topics:
Configuration
Catalyst 6500 CatOS QoS Verification Commands
For most Catalyst 6500 switch ports, setting the trust state to trust DSCP is a relatively straightforward
command (in either CatOS or in IOS).
In this first example, DSCP trust is configured on a port in CatOS; in the second, DSCP trust is
configured on a port/interface in IOS.
Version 3.3